CopyObjection: Fending off ransomware in AWS

This report examines how attackers can leverage AWS S3 server-side encryption with customer-managed keys (SSE-C) to perform copy-in-place ransomware, and evaluates a native AWS detection-and-response pipeline. It details a test setup using CloudTrail and CloudWatch to alarm on rapid CopyObject activity and trigger a Lambda function for automated remediation (disabling access keys or applying deny-all), alongside guidance on preventative configurations.